JA EN
shiichan

Amazon S3 Object Lock Gets Event Holds! Now You Can Start WORM Protection from a Future Event

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi, it's me, Shiichan! Today I've got a story from AWS What's New about S3 getting a little smarter about protecting your data.

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced Event Holds, a new capability for Amazon S3 Object Lock. Until now, Object Lock required you to know the retention period upfront. With Event Holds, you can start a WORM (Write Once Read Many) retention period from a future event — like a contract closing or an audit completing — instead of a fixed date.

The story so far

Before this, the closest tool for "retain data starting from a future event" was Legal Holds. But Legal Holds end protection immediately the moment you remove the hold, which doesn't fit retention requirements that need protection to continue for a set period after the triggering event happens.

What changes

With Event Holds, you place a hold with a retention duration on an object. S3 protects the object for as long as the hold is in place. When you release the hold, S3 keeps retaining the object for the duration you specified. That lets you meet event-based retention requirements — like "keep this for three years after the audit closes" — without holding onto data longer than your policy actually requires.

Dive Deep

You can apply Event Holds in a few ways:

  • On individual objects
  • As a bucket default
  • At scale with S3 Batch Operations

The management side is solid too:

  • New IAM and bucket policy condition keys let you control who can set or release holds
  • You can enforce minimum or maximum hold durations
  • AWS CloudTrail logs every hold operation
  • S3 Inventory reports hold status across your buckets

Event Holds are available in all AWS Regions, including the China Regions, at no additional charge. The capability has also been assessed by Cohasset Associates for use in environments subject to SEC Rule 17a-4(f), FINRA Rule 4511, and CFTC Regulation 1.31.

Wrap-up

  • S3 Object Lock now supports Event Holds, which start a retention period from a future event
  • Unlike Legal Holds, protection continues for a set duration even after you release the hold
  • You can apply it to individual objects, as a bucket default, or at scale with Batch Operations
  • IAM condition keys, CloudTrail, and S3 Inventory cover management and auditing
  • Great for engineers in regulated industries — finance, healthcare — who need retention tied to real-world events like contract closings or audits

Related posts